d02a665bcfb13f8bfaa8ae70fb429f31b1cac9aaecb2d6d9db34745fdfeec132

Sharing

Copy URL Twitter E-mail

General

Target
Your.Only.Move.is.HUSTLE.v1.9.19.zip
Size 92.5MB
Sample241109-28jedsvalh
SHA256 d02a665bcfb13f8bfaa8ae70fb429f31b1cac9aaecb2d6d9db34745fdfeec132
MD5 a0ad3d669e8ea0171cce667c6fb8dc06
SHA1 4fc8701741d82da04358e74e739985e4bee6cccf
SHA512 61886b2ab6eed43e7b5c417c9aa532ea73e760dcd0372b5db700966d1dabd3263010e37e9f4c8acab8365bedcba03adbd15c13889b5976a6a5d02d842bc5ba2e
SSDEEP 1572864:YZvyWtGIG9421+lVsuGNCCdQcrfBW3WKsL+zd1MepdP/H4kp+xHbBpR9XPqi3F7d:mYIqtSVBGNk45W0GdH/Ykp+ZTXCi3JAM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/STEAMUNLOCKED » Free Steam Games Pre-installed for PC.url
- Size 52B
- SHA256 677d2e85447eea64fa541b8e8a9e92b41e20456360bef8642f898e7eb1b2f0db
- MD5 92672216743fd0ad8799d25ec99e5096
- SHA1 68103be0fa83db8a4a2efac6bb6169ce959a0290
- SHA512 1ca286141902e64c4cac05fabc1ce0ef4d910582e720c8b38f3cf2799cadaab7cbc9d8fc925eff17e0d3280d5d074ebd856dc75d6cadbd95872cae14eddb7719
- MD5 SHA1 SHA512
Score

1^/10
behavioral1 behavioral2
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.cmd
- Size 38B
- SHA256 90a686434146f2dd6b6d4339e118a731fc3f64deeb6b3507f5202a57361b0f30
- MD5 c4d6605c40c7f4bdec7f1c96491c6e4a
- SHA1 43e3ff93298183c2a5496116a1b05ee99dd50ac4
- SHA512 ac7f32d3e8522d0a152bce9eb7dd54832ac3c7cb76c4038340434d67e7199813f7ff570573f70c90db91249b0ca46cc0bda322f2b76141487018bf05dab74de3
- MD5 SHA1 SHA512
Score

1^/10
behavioral3 behavioral4
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.exe
- Size 41.0MB
- SHA256 9cb277ae5c9d1c89058426270cdc0c58e22a4d9b148ac3aebf1fe20b50a62bfd
- MD5 677c486cadd78c34c882aa6c8161132c
- SHA1 f015bfb07d9f8a54bf50937ba8822adb6e9e1cd7
- SHA512 485fc618c164697f8a8a4767f0aa495477c417238482e734125e99dcf259aa3527837bfc39787b1b650de937d109d17b8a3406b639e93de4615eed1d60b0dab6
- SSDEEP 393216:sAnZtt1CNkTixGEmgiKGWYiGcbfVxBHkSF8uvywzluXQr9LKVF+S3ea3QgiHkXWS:snPEXDyiIQe5l
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5 behavioral6
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/YourOnlyMoveIsHUSTLE.x86_64
- Size 48.8MB
- SHA256 3b49814e900240f15d5c6cffa8cff4f0295db3574366ec9c63d8a980d2900562
- MD5 545b14560c11b1819b6b5d7870282d08
- SHA1 8aa7c3a606179c2c31c7a1d78f9c76bcdefd5a25
- SHA512 4e05db3008751ed569f048e6d920b2d1509aeafce4934feddbea6c3fe29b4efa65acd1eac793f49024900d9fcabcb8ee94d87ca35da143a76936a7b179df42fa
- SSDEEP 393216:o9lyce5rZSW15i0L5zuGQw+csUGseiJT/F8BDw+mZL6Jwz:o9AsWPj8w5sUBJT/FEW2iz
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery keylogger
- Reads hardware input events
  Reads raw input events from the evdev driver, possibly to record keystrokes.
  keylogger discovery
behavioral7
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/libsteam_api.so
- Size 411KB
- SHA256 c0cc3d2802e5f2463bfa0046c41d2f65a6335baaeefbba6c7dbd5681d5ca7c46
- MD5 9fb2f341377ac3192369199ab8862138
- SHA1 95dcd3f3e03c0674e6604968a645c1d83d3caba9
- SHA512 18bcb6d918d3a24c4a546295e2adceb2d9064bcc5546c84c9191a371bcf18f4a96d47cd48d6a57676cf4baa42531edc26de7044b718a07ff6cca86ad8c25ac62
- SSDEEP 6144:pfwFZwCjnQDUEkWTyPnHmoOyFV2EOIuA/mVVDoV8YWK4zHdbQgPwFfwCjnQIUEk7:p7Cjn6hGx92ERl4xZpCjnjhg
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/steam_api64.dll
- Size 1.9MB
- SHA256 eb9b78ef3c339591c1993c9c364098de386edd391e1169ea0a6daa39ae9735a9
- MD5 37a7e0deae6e7bd1154f8fd059f9a241
- SHA1 5787b8db0d0d656d13474cd7d2caf66c443e181c
- SHA512 6d375c3abceb83a48b277ebafa7da24128fa97cdde7b3f3e89970671582ff3af8a413fead8d074127a97fc34cc423fd218f878ee3a218f6f28be3aededbf83f7
- SSDEEP 24576:0Nip4KmiEeJARIEOzje4nKGyAJ1VyKm9m0DKXC5CMcWXoyefCJXS0abv:EM/mIYI37p7VyKmTcMcWXAfCHab
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/tbfg.dll
- Size 1.1MB
- SHA256 1955831c2c30c026321117c3f95a54f4378ebf51c7763824b4aac346f1824f32
- MD5 a6ca3968cc5d6dc8b9de1b1114a7cf35
- SHA1 890efbc05e3d76fef8387a420de70a3cd0911cb2
- SHA512 b33eedd6d1ca65c02d12eb79da41a13c7797432962eeff004ca7f333394b601ebd8ae66eda7b465c26be632f883c0b6374b195a1c11e98d9cf65cc503d726f50
- SSDEEP 12288:C9yzfRpBpBLEgUopD792IeWkja7HetgguuDHkakVwG7lAx4e6RW1dsxPpwzhe:LLZpH92I6ja7HAzuuDHm7AGW1dsXm
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/tbfg.so
- Size 4.9MB
- SHA256 edd2e7e91d70a0c52c182d0f68f46a6cde9953607603e4decdb60dcd95fe957e
- MD5 4daa0f93e4e314a0ba61a31a51aaf398
- SHA1 4b1fd250590f23e2ac833fe0057ab4a9dcb98743
- SHA512 c9569ff853252cee8ef04063d514574a270c4ba2c7135c45ac700dd1961350dced7251344208b3fbc23cf049fe5c35ec9a93cbca9234804c2f79306cd174bd2f
- SSDEEP 49152:1fZtwkpfEHHp9G73KW1isHYPyPyNXuZxt7s3eijuCWqUK9WjXnFFrUS2tRTIX9vZ:Dc6KW1isGBZWdqTwix91OvFWG
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/Your.Only.Move.is.HUSTLE.v1.9.19/vcruntime140.dll
- Size 96KB
- SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
- MD5 f12681a472b9dd04a812e16096514974
- SHA1 6fd102eb3e0b0e6eef08118d71f28702d1a9067c
- SHA512 7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
- SSDEEP 1536:BxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8i10DWZz:Bvk4wHH+mZD4ADAecb8G1
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14 behavioral15
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/dotNetFx40_Full_setup.exe
- Size 868KB
- SHA256 fa1afff978325f8818ce3a559d67a58297d9154674de7fd8eb03656d93104425
- MD5 53406e9988306cbd4537677c5336aba4
- SHA1 06becadb92a5fcca2529c0b93687c2a0c6d0d610
- SHA512 4f89da81b5a3800aa16ff33cc4a42dbb17d4c698a5e2983b88c32738decb57e3088a1da444ad0ec0d745c3c6b6b8b9b86d3f19909142f9e51f513748c0274a99
- SSDEEP 24576:+tW4x8xAxCdUcyezFSjaBHFaNlsqK5/oh6iZf1LUXw/vxNI:d4x8xqCGexm8FCspg0iZf1LUXD
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral16 behavioral17
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/dxwebsetup.exe
- Size 281KB
- SHA256 111aeddc6a6dbf64b28cb565aa12af9ee3cc0a56ce31e4da0068cf6b474c3288
- MD5 fd6057b33e15a553ddc5d9873723ce8f
- SHA1 f90efb623b5abea70af63c470daa8674444fb1df
- SHA512 d894630c9a4bdb767e9f16d1b701acbdf011e721768ba0dc7a24e6d82a4d062a7ca253b1b334edba38c06187104351203a92c017838bdd9f13905cde30f7d94d
- SSDEEP 6144:pWK8EGMUjp5cGQ3Mek1B3B9h8Ins3i8AEYBSawz1YSc:JGvjp5cj35kDB9hrs3zARBSaJSc
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral18 behavioral19
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/oalinst.exe
- Size 790KB
- SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
- MD5 694f54bd227916b89fc3eb1db53f0685
- SHA1 21fdc367291bbef14dac27925cae698d3928eead
- SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
- SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral20 behavioral21
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/vcredist_2015-2019_x64.exe
- Size 14.3MB
- SHA256 b6c82087a2c443db859fdbeaae7f46244d06c3f2a7f71c35e50358066253de52
- MD5 f0248d477e74687c5619ae16498b13d4
- SHA1 9ed4b091148c9b53f66b3f2c69be7e60e74c486a
- SHA512 0c373b06ffe84f3e803831e90f22d7d73304e47a47839db614f63399ff1b7fcf33153bf3d23998877c96d2a75e316291a219fdd12358ca48928526284b802591
- SSDEEP 393216:q5lptVYmfr7yBG/4WoI+j6LTinXKSf0fzTDv8:q7pttD7yBG/uljIinXj0fQ
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral22 behavioral23
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/vcredist_2015-2019_x86.exe
- Size 13.7MB
- SHA256 ac96016f1511ae3eb5ec9de04551146fe351b7f97858dcd67163912e2302f5d6
- MD5 de34b1c517e0463602624bbc8294c08d
- SHA1 5ce7923ffea712468c05e7ac376dd9c29ea9f6be
- SHA512 114bca1ecd17e419ad617a1a4341e607250bcb02626cdc0670eb60be734bbad1f3c84e38f077af9a32a6b1607b8ce6e4b3641c0faefaa779c0fec0d3ac022dac
- SSDEEP 393216:/d/FlptVYmfr7yBG/4JU4TRjtjUMy4i6kgsY7i:/1PpttD7yBG/QHTJtYMyke9
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral24 behavioral25
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/vcredist_x64.exe
- Size 5.5MB
- SHA256 b06546ddc8ca1e3d532f3f2593e88a6f49e81b66a9c2051d58508cc97b6a2023
- MD5 630d75210b325a280c3352f879297ed5
- SHA1 b330b760a8f16d5a31c2dc815627f5eb40861008
- SHA512 b6e107fa34764d336c9b59802c858845df9f8661a1beb41436fd638a044580557921e69883ed32737f853e203f0083358f642f3efe0a80fae7932c5e6137331f
- SSDEEP 98304:EuLgywiNHBeSLxYK/bxE3q/BlZkWMGPQflVJ/EK1sLyzs2T2Q1mOjq4/:V7wqheSVYK/bua/BlWWnuVhsus8nm+qi
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral26 behavioral27
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/vcredist_x86.exe
- Size 4.8MB
- SHA256 8162b2d665ca52884507ede19549e99939ce4ea4a638c537fa653539819138c8
- MD5 b88228d5fef4b6dc019d69d4471f23ec
- SHA1 372d9c1670343d3fb252209ba210d4dc4d67d358
- SHA512 cdd218d211a687dde519719553748f3fb36d4ac618670986a6dadb4c45b34a9c6262ba7bab243a242f91d867b041721f22330170a74d4d0b2c354aec999dbff8
- SSDEEP 98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
behavioral28 behavioral29
- Target
  Your.Only.Move.is.HUSTLE.v1.9.19/_Redist/xnafx40_redist.msi
- Size 6.7MB
- SHA256 e6c41d692ebcba854dad4b1c52bb7ddd05926bad3105595d6596b8bab01c25e7
- MD5 97c2eebb30c5a88c68c8f24f37183f1d
- SHA1 49efdc29f65fc8263c196338552c7009fc96c5de
- SHA512 c9d1017b274ceb1b4ee624cf7e628787c32a727c64f715fbce1f1ae929d9114f8fe1291e34583cec615619b0128c01206b07efc878e7a5c57b792453f73fd0da
- SSDEEP 98304:wynfL329J1XswfXO6wiBB+4RZg6aENaCZAU5PMO0MntfERyJGH2YPq/:wYD3C1XXfzH+4cLHU5PM/Mnt+YGlq
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

discovery persistence privilege_escalation
- Blocklisted process makes network request
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral30 behavioral31